ALBERT SITE

1. 별도의 추가설치없이 yum install 로 바로설치하면됨

[kafka@localhost bin]$ yum install filebeat

============================================================================================================================================
Package                        Arch                         Version                          Repository                               Size
============================================================================================================================================
Installing:
filebeat                       x86_64                       7.17.9-1                         elasticsearch-7.x                        34 M

Transaction Summary
============================================================================================================================================
Install  1 Package

Total download size: 34 M
Installed size: 125 M
Is this ok [y/d/N]: y
Downloading packages:
filebeat-7.17.9-x86_64.rpm                                                                                           |  34 MB  00:00:05
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : filebeat-7.17.9-1.x86_64                                                                                                 1/1
Verifying  : filebeat-7.17.9-1.x86_64                                                                                                 1/1

Installed:
filebeat.x86_64 0:7.17.9-1

Complete!

2. logstash output 설정

[kafka@localhost bin]$ sudo vi /etc/filebeat/filebeat.yml 

' ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
' Array of hosts to connect to.
hosts: ["localhost:9200"]

' Protocol - either `http` (default) or `https`.
'protocol: "https"

' Authentication credentials - either API key or username/password.
'api_key: "id:api_key"
'username: "elastic"
'password: "changeme"

' ------------------------------ Logstash Output -------------------------------
'output.logstash:
' The Logstash hosts
hosts: ["localhost:5044"]

' Optional SSL. By default is off.
' List of root certificates for HTTPS server verifications
'ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

' Certificate for SSL client authentication
'ssl.certificate: "/etc/pki/client/cert.pem"

' Client Certificate Key
'ssl.key: "/etc/pki/client/cert.key"

output 항목중 9200,5044 부분 주석해제 만약 다른포트 사용을 원하면 변경후 저장하면됨

3. filebeat 실행

systemctl restart filebeat

끝